Is CVE-2026-54246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54246 being exploited in the wild.

How severe is CVE-2026-54246?

Medium severity, with a CVSS score of 5.7, published 14 September 2026.

Which products and versions are affected?

github.com/zalando/skipper (Go) < 0.27.13, SEMVER:introduced=0,fixed=0.27.13; Zalando Skipper < 0.27.13.

Is there a fix for CVE-2026-54246?

Yes. github.com/zalando/skipper (Go): upgrade to 0.27.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54246 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-54246?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54246: Zalando Skipper missing authentication in routesrv API endpoints

Q: Is there a fix for CVE-2026-54246?

Yes. github.com/zalando/skipper (Go): upgrade to 0.27.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54246 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-54246?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54246 · Severity: medium · CVSS 5.7 · Published 2026-09-14

Zalando Skipper is an HTTP router and reverse proxy for service composition. A security flaw in its route server component allows any application within the same Kubernetes cluster to access sensitive infrastructure data without authentication. An attacker who compromises a single low-privilege application could use this to map out the entire network, identify internal service locations, and potentially access session or rate-limiting data in Redis or Valkey caches.

Technologies: github.com/zalando/skipper (Go), Zalando Skipper. Vendors: Go, Zalando.

Quick answers

Is CVE-2026-54246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54246 being exploited in the wild.
How severe is CVE-2026-54246?: Medium severity, with a CVSS score of 5.7, published 14 September 2026.
Which products and versions are affected?: github.com/zalando/skipper (Go) < 0.27.13, SEMVER:introduced=0,fixed=0.27.13; Zalando Skipper < 0.27.13.
Is there a fix for CVE-2026-54246?: Yes. github.com/zalando/skipper (Go): upgrade to 0.27.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54246 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-54246?: Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zalando/skipper (Go): upgrade to 0.27.13 or later
```
go get github.com/zalando/skipper@v0.27.13
```

Technical details

The `routesrv` component in Zalando Skipper fails to implement authentication for its HTTP API endpoints, including `/routes`, `/swarm/redis/shards`, and `/swarm/valkey/shards`. Because the component runs with cluster-wide RBAC permissions to aggregate Ingress and RouteGroup data, it inadvertently exposes this sensitive information to any client that can reach its predictable Kubernetes DNS name. An attacker with a foothold in any pod within the cluster can bypass namespace-level isolation to perform reconnaissance on internal service URLs, filter chains (including OAuth/JWT policies), and cache shard addresses. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). A fix is available in version 0.27.13, which introduces authentication capabilities for the route server.

Affected products

Zalando skipper < 0.27.13

Identifiers

CVE-2026-54246
GHSA-5587-2x54-jj6h
GO-2026-6018

Timeline

2026-06-24: disclosed
2026-06-24: patched: Version 0.27.13 released
2026-07-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.